CERT-FR Flags Oracle Virtualization Vulnerabilities
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory lists multiple vulnerabilities in Oracle VM VirtualBox and Enterprise Manager for Virtualization enabling RCE, DoS, and data exposure.
CERT-FR has issued an advisory summarizing multiple vulnerabilities affecting Oracle Virtualization products, based on Oracle's October 2026 Critical Patch Update (cpuoct2026). Affected products include Oracle Enterprise Manager for Virtualization version 13.5 and Oracle VM VirtualBox versions 7.2.16 and 7.2.20. The vulnerabilities, tracked under seven CVE identifiers, collectively allow an attacker to achieve remote arbitrary code execution, remote denial of service, and breach of data confidentiality, as well as potential bypass of security policies.
No evidence of active exploitation in the wild is mentioned in the advisory. CERT-FR recommends administrators consult Oracle's official security bulletin for patch details and apply fixes according to Oracle's guidance. Given the breadth of impact (RCE, DoS, confidentiality loss) across widely deployed virtualization software, organizations running affected VirtualBox or Enterprise Manager versions should prioritize patching promptly, particularly in environments where VirtualBox is used to run untrusted or externally-sourced guest images, which could expose host systems to guest-to-host escape style attacks.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1354
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs